SC-900 Practice Test 33 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel. You need to create an analytics rule that triggers an incident when more than 10 failed sign-ins occur from a single IP address within 5 minutes. Which rule type should you use?

Accepted Answer

Scheduled query rule. Scheduled query rules run at intervals and can aggregate events. Option B is correct. Option A (NRT) provides near-real-time but limited aggregation. Option C (ML Behavior Analytics) uses ML. Option D (Fusion) correlates alerts.

Answer

Fusion rule

Answer

Near-real-time (NRT) rule

Answer

ML Behavior Analytics rule

Question 2

Refer to the exhibit. You are reviewing an ARM template for an Azure resource. Assuming the resource is a Key Vault, what is the effect of the networkAcls configuration?

Accepted Answer

The Key Vault is accessible only from the 10.0.0.0/24 subnet.. The defaultAction is Deny, but an IP rule allows traffic from 10.0.0.0/24. So only that subnet can access the Key Vault. Option D is correct. Option A is wrong because public network access is disabled, so it's not accessible from the internet. Option B is wrong because the IP rule allows the subnet. Option C is wrong because the default action is Deny, not Allow.

Answer

The Key Vault is accessible from any network.

Answer

The Key Vault is accessible from all Azure services.

Answer

The Key Vault is not accessible from any network.

Question 3

Which TWO capabilities are provided by Microsoft Defender for Cloud Apps?

Accepted Answer

Cloud Discovery to identify shadow IT. Option A is correct because Defender for Cloud Apps provides cloud discovery to identify shadow IT. Option C is correct because it offers DLP capabilities for cloud apps. Option B is wrong because endpoint detection is provided by Defender for Endpoint. Option D is wrong because identity protection is provided by Entra ID Protection. Option E is wrong because email security is provided by Defender for Office 365.

Answer

Email security

Answer

Endpoint detection and response

Answer

Identity protection

Question 4

Your organization uses Microsoft Defender XDR. You need to investigate a potential lateral movement attack where a compromised user account is used to access multiple workstations. Which feature should you use to visualize the attack path?

Accepted Answer

Attack graph. Option B is correct because the attack graph in Microsoft Defender XDR provides a visual representation of attack paths. Option A is wrong because the incident queue lists alerts, not attack paths. Option C is wrong because Microsoft Sentinel's workbooks are for custom visualization but not specifically for attack paths. Option D is wrong because Microsoft 365 Defender's threat analytics provide threat reports, not attack paths.

Answer

Microsoft Sentinel workbooks

Answer

Threat analytics in Microsoft 365 Defender

Answer

Incident queue

Question 5

Your organization uses Microsoft Defender for Cloud to secure Azure resources. You need to ensure that all storage accounts have soft delete enabled to protect against accidental deletion. Which policy should you implement?

Accepted Answer

Azure Policy with a built-in policy for storage accounts. Option A is correct because Azure Policy can audit or enforce configurations on resources, including enabling soft delete on storage accounts. Option B is wrong because Defender for Cloud recommendations suggest actions but do not enforce them automatically. Option C is wrong because Azure RBAC controls permissions, not configurations. Option D is wrong because Azure Blueprints package resources but do not enforce individual settings.

Answer

Azure Blueprints

Answer

Azure role-based access control (RBAC)

Answer

Defender for Cloud security recommendations

Question 6

A company uses Microsoft Intune to manage its devices. The security team wants to enforce that all devices running Windows 11 must have BitLocker enabled and a minimum operating system build version. Which Intune policy type should they use?

Accepted Answer

Compliance policy. Option A is correct because compliance policies enforce device compliance rules like BitLocker and OS version. Option B is wrong because configuration profiles configure settings, not compliance. Option C is wrong because app protection policies manage data on mobile apps. Option D is wrong because enrollment restrictions limit device enrollment.

Answer

Configuration profile

Answer

Enrollment restriction

Answer

App protection policy

Question 7

Your organization is planning to use Microsoft Sentinel as a SIEM solution. Which TWO of the following are required components for Sentinel? (Select TWO.)

Accepted Answer

A Log Analytics workspace. Options A and C are correct: A Log Analytics workspace is the underlying data store, and data connectors are needed to ingest logs. Option B is wrong because a playbook is optional automation. Option D is wrong because a KQL query is used for analysis but not a required component. Option E is wrong because a workbook is optional visualization.

Answer

A playbook for automated response

Answer

A workbook for dashboards

Answer

A KQL query for threat detection

Question 8

Which THREE of the following are features of Microsoft Purview Communication Compliance?

Accepted Answer

Provide policy tips to users when they send potentially non-compliant messages. Microsoft Purview Communication Compliance helps detect policy violations in communications. Option A is correct because it can analyze Microsoft Teams messages. Option C is correct because it allows custom keyword dictionaries. Option E is correct because it provides policy tips to users. Option B is wrong because it is a feature of Microsoft Defender for Office 365. Option D is wrong because it is a feature of Microsoft Entra ID.

Answer

Automatically quarantine emails that contain malware

Answer

Enforce multi-factor authentication for sensitive roles

Question 9

You are reviewing a Microsoft Purview DLP policy configuration as shown in the exhibit. What is the expected behavior when a user sends an email containing a credit card number to an external recipient?

Accepted Answer

The email is blocked, and the user receives a policy tip notification.. The policy has a rule that blocks access for external sharing when credit card numbers are detected. Option A is correct because the policy blocks the email and notifies the user with a policy tip. Option B is wrong because the policy blocks external sharing. Option C is wrong because the policy does not allow override. Option D is wrong because the policy does not allow internal sharing.

Answer

The email is delivered, but the user receives a warning.

Answer

The email is delivered, and the user is asked to provide a business justification.

Answer

The email is blocked, but only if the recipient is external and internal recipients are allowed.

Question 10

Your organization uses Microsoft Sentinel for security operations. You need to ensure that when a high-severity incident is created, a Microsoft Teams message is sent to the SOC team automatically. What should you configure?

Accepted Answer

Create an automation rule that triggers on incident creation and runs a playbook.. Automation rules in Microsoft Sentinel allow you to trigger automated responses, such as sending a Teams message, based on incident creation conditions. Playbooks are run by automation rules, but the rule itself defines the trigger. Option B is correct because automation rules are the mechanism to trigger playbooks on incident creation. Option A is wrong because playbooks are the actions, not the trigger. Option C is wrong because analytics rules create incidents but do not directly send notifications. Option D is wrong because workbooks are for visualization, not automation.

Answer

Create a playbook and attach it to an analytics rule.

Answer

Modify the analytics rule to include an automated response.

Answer

Configure a workbook to send email alerts.

Question 11

Your company uses Microsoft Defender for Cloud Apps. You want to discover which cloud apps are being used in your organization and assess their risk levels. What should you use?

Accepted Answer

Cloud Discovery. Microsoft Defender for Cloud Apps provides Cloud Discovery to analyze traffic logs and identify shadow IT. Option B is correct. Option A is wrong because Defender for Cloud Apps does not have a 'Cloud App Security Catalog' feature. Option C is wrong because Microsoft Intune manages devices, not app discovery. Option D is wrong because Microsoft Purview is for data governance, not app discovery.

Answer

Cloud App Security Catalog

Answer

Microsoft Purview Data Map

Answer

Microsoft Intune app inventory

Question 12

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. The JSON snippet shows a rule designed to create an incident when a high-severity alert is generated. However, the rule is not triggering. What is the most likely reason?

Accepted Answer

Automation rules triggered on alert creation cannot create incidents; they can only run playbooks.. The JSON shows a trigger type 'Microsoft.SecurityInsights/AlertRule' which is used for automation rules that run on alert creation. However, the action type is 'Microsoft.SecurityInsights/AlertRule/Incident' which is intended to create an incident from an alert. The issue is that automation rules that trigger on alert creation cannot directly create incidents; they can only run playbooks. To create an incident from an alert, you need to use an automation rule triggered on incident creation or use an analytics rule. Option B is correct. Option A is wrong because the syntax is correct. Option C is wrong because the resource ID is present. Option D is wrong because the trigger is on alert, not incident.

Answer

The logicAppResourceId is missing a required parameter.

Answer

The action should be of type 'Microsoft.SecurityInsights/AlertRule/Alert' instead.

Answer

The trigger type is incorrect; it should be 'Microsoft.SecurityInsights/Incident'.

Question 13

Which THREE are features of Microsoft Purview Data Loss Prevention (DLP)?

Accepted Answer

DLP policies for Exchange Online. Microsoft Purview DLP includes policy tips to notify users, endpoint DLP to monitor devices, and integration with Microsoft 365 services. Option A is correct. Option B is correct. Option C is correct. Option D is wrong because sensitivity labels are part of Microsoft Purview Information Protection, not DLP. Option E is wrong because insider risk management is a separate solution.

Answer

Sensitivity label auto-classification

Answer

Insider risk management analytics

Question 14

Your company wants to use Microsoft Defender for Identity to detect security threats from on-premises Active Directory. What is a prerequisite for deploying Defender for Identity?

Accepted Answer

Install a sensor on a domain controller. Microsoft Defender for Identity requires a domain controller or AD FS server to be installed with the sensor. Option C is correct. Option A is wrong because the sensor must be installed on a domain controller, not a workstation. Option B is wrong because Azure AD Connect sync is not required. Option D is wrong because Microsoft 365 E5 license is needed, but the sensor is installed on DCs.

Answer

Obtain Microsoft 365 E3 licenses

Answer

Install a sensor on each user's workstation

Answer

Configure Azure AD Connect

Question 15

Which THREE capabilities are provided by Microsoft Defender XDR? (Choose THREE.)

Accepted Answer

Advanced hunting. Microsoft Defender XDR provides incident management (correlated alerts), automated investigation and response (self-healing), and advanced hunting (KQL queries). Vulnerability management is part of Defender for Endpoint, not the XDR platform. Cloud security posture management is from Defender for Cloud. Defender XDR is for cross-domain threat protection.

Answer

Cloud security posture management

Answer

Vulnerability management